Autumn-27/ARTEX

What it solves

ARTEX is an autonomous penetration testing system designed to automate the complex process of security auditing and vulnerability discovery. It replaces manual, repetitive security probing with an AI-driven approach that can independently plan and execute attack chains, track assets, and document findings.

How it works

The system uses a multi-agent architecture powered by the norma SDK, consisting of a Planner (which generates intentions based on goals) and multiple Workers (which execute those intentions using real-world tools like Bash, HTTP, and Nmap).

It relies on a Dual-Graph Architecture:

• Asset Graph: A global truth store tracking the hierarchy of domains, IPs, services, and endpoints.
• Exploration Graph: A per-task map of the "thought process," linking goals, intentions, facts, and findings into a lineage chain.

To ensure stability, the Planner maintains a persistent shared todolist across sessions to execute multi-step attack sequences (e.g., injection $\rightarrow$ credential theft $\rightarrow$ lateral movement) in the correct order. Workers can also exchange information by searching through each other's execution traces to avoid redundant work.

Who it’s for

• Security researchers and penetration testers who want to automate the reconnaissance and exploitation phases of a security audit.
• Organizations looking to perform continuous, autonomous security testing of their digital assets.

Highlights

• Autonomous Attack Chains: Capable of independently navigating multi-step exploitation paths via a shared planning list.
• Dual-Graph Tracking: Separates the "what is the target" (Asset Graph) from the "how far have we gone" (Exploration Graph).
• Human-in-the-Loop: Includes a web interface for monitoring activity, approving tool execution (intercept), and chatting with the agent.
• Asset Synchronization: Integrates with ScopeSentry to import target assets directly.
• Full Observability: Features a MITM proxy for recording all traffic and a visual asset coverage map.